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VOLUME VIII 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx-xx-9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer-Henderson Hall, 

Fort Myer, VA 22211 

/ 

The Hearing in the above-entitled matter was 
held on Monday, June 18, 2013, commencing at 9:30 a.m., 
at Fort Meade, Maryland, before the Honorable Colonel 
Denise Lind, Judge. 
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DISCLAIMER 

This transcript was made by a court reporter 
who is not the official Government reporter, was not 
permitted to be in the actual courtroom where the 
proceedings took place, but in a media room listening 
to and watching live audio/video feed, not permitted to 
make an audio backup recording for editing purposes, 
and not having the ability to control the proceedings 
in order to produce an accurate verbatim transcript . 

This unedited, uncertified draft transcript 
may contain court reporting outlines that are not 
translated, notes made by the reporter for editing 
purposes, misspelled terms and names, word combinations 
that do not make sense, and missing testimony or 
colloquy due to being inaudible by the reporter. 
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PROCEEDINGS, 

THE COURT: Court is called to order. Let 
the record reflect all parties present when the court 
last recessed. 

All right. The court has prepared an order, 
review of stipulations of expected testimony, dated 18 
June 2013 with a suspension date of three business or 
duty days . 

One . To date the government has introduced 
stipulations of expected testimony of 33 government 
witnesses . Those stipulations have been admitted into 
evidence and read on the record. The parties notified 
the court they anticipate entering into approximately 17 
additional stipulations of expected testimony by 21 June 
2013. 

Two . The government notified the court that 
government organizations with equities involved have 
requested to review certain stipulations of expected 
testimony before they are admitted into evidence and read 
on the record. The government wishes to accommodate this 
request and proposes to have those stipulations signed by 
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the parties before sending them to the government 
organizations for review. Defense does not object. 

Order. One. The court approves the 
government ' s request for the requested reviews so long as 
the reviews do not unreasonably delay the trial . All 
reviews of stipulations of expected testimony will be 
completed within three duty or business days after the 
party and the accused enter into the stipulation. 

Two . This order is issued under the court ' s 
authority to regulate the proceedings under Rules of 
Court -Martial 801 and to compel the production of 
witnesses under Rule for Court-Martial 703. Should any 
government organization request to review a stipulation 
and fail to conduct this review within this timeframe, 
the government will elect to offer the stipulation into 
evidence, call the subject witness, or forego the use of 
the testimony in the government ' s case in chief . So 
ordered this 18th day of June, 2013. 

Please add that as the next appellate exhibit 
in line. Is there anything else we need to address 
before we proceed to argue the motion? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/18/13 Morning Session 

6 

MR. FEIN: Your Honor, just two 
administrative issues. First, yesterday what has been 
marked as appellate exhibit 572 has been filed with the 
court, witness list order and proposed PE of government 
witnesses, dated 17 June which included the 17 
stipulations you just referenced in your order, that's 
been marked as appellate exhibit 572 . 

Also this morning, Your Honor, as of this 
morning's start of court there are nine media members in 
the media room, one stenographer in the media room, four 
members of the media in the courtroom, four spectators in 
the courtroom, and currently no one in the trailer but it 
is available. 

THE COURT : All right . Thank you . 

At issue are the defense objections to 
prosecution exhibits 31, 32 and 109, prosecution exhibits 
for identification. And I believe the objections were 
authentication, hearsay and relevance, is that correct? 

MR . COOMBS : That ' s correct , ma ' am . 

THE COURT: All three of the exhibits? 

MR. COOMBS: Yes, ma'am. 
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THE COURT: I've already admitted prosecution 
exhibit 110 for identification. 

Government, as you have the burden of proof, 
would you like to proceed? 

MR. von ELTEN : Yes, ma'am. 

THE COURT : Let ' s go exhibit by exhibit if we 

will. 

Before you start, can I ask, I'll ask the 
defense this as well, for prosecution exhibits 31 and 32 
for identification will the arguments be the same? 

MR. von ELTEN: Similar, ma'am. 

THE COURT: But different? 

MR. von ELTEN: But different. 

THE COURT: Go ahead. 

MR. von ELTEN: Your Honor, the United States 
believes it ' s made a prima facie showing of 
authentication and therefore all defense arguments should 
go to weight and not admissibility. I'll start off with 
the internet archive, ma'am. 

THE COURT: I would prefer if you would do 
plaintiff's exhibits 31 and 32 first. Can you do that? 
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MR. von ELTEN : Yes, ma'am. 
THE COURT: Thank you. 

MR. von ELTEN: Prosecution exhibit 31 for 
identification, ma'am, is a tweet. The United States 
offers it as a tweet from WikiLeaks requesting dot mil 
email addresses . 

To lay out the history of how Agent Mander 
collected it, Agent Mander testified that he collected 
that information witness statement in two different ways . 
First Agent Mander testified that he went to WikiLeaks 
personally a year ago, WikiLeaks Twitter account at 
Twitter dot com, and actually saw the tweet located 
directly on the website . Then Agent Mander testified 
that he more recently went to a Google cache version and 
searched for it and located it . He testified that he 
compared it to and found the contents to be the same. 

Agent Mander testified that he's familiar 
with Google cache as something that saves the result and 
makes it accessible for viewing. Agent Mander also 
testified that he uses Google cache in his official 
capacity as a CID agent and uses it regularly. 
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Therefore, Agent. Mander authenticated the 
prosecution exhibit 31 for identification based on his 
own personal knowledge . 

Furthermore, Agent Mander testified about the 
identifying characteristics of the email tweet . He 
talked about the logo, the location where he found it on 
Twitter dot com, the account name being WikiLeaks, and 
the content of the tweets all being relevant, things that 
would make it WikiLeaks . 

Furthermore, the Twitter account under 
WikiLeaks is deemed as (INAUDIBLE) making it more likely, 
making it WikiLeaks account making it (INAUDIBLE) . 
Because the tweet is authenticated under Agent Mander ' s 
testimony, any evidence of the defense wishes to offer 
should go to weight, not admissibility. 

As for hearsay, Your Honor, the United States 
offers PE 31 for identification for effect on listener. 
Specifically we're offering it to explain PFC Manning's 
course of action. On 7-8-2010, WikiLeaks posted a tweet 
asking for dot mil email addresses . Special Agent 
Williamson testified that there were five files related 
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to the dot mil email addresses located on the computer to 
which PFC Manning had access. The files were, quote, 
recreated and deleted on May 13, 2010, and in between 
deleting and creating (INAUDIBLE) the user of the Peter 
Bigelow account also viewed the Bradley Manning Gmail 
email inbox . 

THE COURT: Who is the witness who testified 

to this? 

MR. von ELTEN: Special Agent Wilson, ma'am. 

The email tweet is relevant because it makes 
it more likely that PFC Manning's intent was to 
compromise the dot mil email addresses and information 
related to them. 

The evidence also corroborates PFC Manning's 
admissions that he performed significant research into 
WikiLeaks and that he talked about compromised 
information with Mr . Lamo . 

Prosecution exhibit 32 for identification, 
the authentication arguments are the same, ma'am. 

The hearsay explanation is slightly 
different . The United States is offering this to explain 
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the nature of WikiLeaks possession and it ' s appropriate 
in this case for non-hearsay use from United States V 
Ellison . 

THE COURT: Stop there again. Prosecution 

exhibit 32. 

MR. von ELTEN : It's the video tweet, 
WikiLeaks saying they have an encrypted video of bomb 
strikes on civilians . 

THE COURT: They have encrypted video. 

MR. von ELTEN: Of bomb strikes on video and 
they need super computer time . 

THE COURT: And the non-hearsay basis is. 

MR. von ELTEN: The non-hearsay basis is 
explanation of the nature of the possession for 
WikiLeaks . WikiLeaks admits to having the video and 
needing it to be decrypted which is evidence that they 
don't have lawful possession of it. This is relevant 
because — 

THE COURT: How does that not go to the truth 
of the matter asserted? 

MR. von ELTEN: Because under United States V 
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Ellison, possession of stolen goods, the explanation of 
the nature of it is admissible in a non-hearsay way as 
part of the res gestae. 

THE COURT: What does res gestae have to do 

with hearsay? 

MR. von ELTEN: Your Honor, in this case the 
case history discusses res gestae which talks about in 
many cases historical forerunners to modern hearsay 
objections, and in this case the statement about the 
possession and the nature of it is treated as almost an 
operative fact . 

THE COURT: So this is United States versus 
Elliott you're talking about? 

MR. von ELTEN: Yes, ma'am. Sorry. Elliott. 

THE COURT: The one cited in your brief. 

MR. von ELTEN: Yes, ma'am. 23 M.J. 1. 

THE COURT: Okay. 

MR. von ELTEN: It's relevant because it's 
evidence of the timing of transmission by PFC Manning. 
The transmission is analogous to a stolen good here in 
the WikiLeaks case because they had unauthorized 
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possession of it. 

The evidence corroborates PFC Manning ' s 
admissions where he explicitly says to Mr. Lamo that 
WikiLeaks has the video. PFC Manning tells Mr. Lamo that 
WikiLeaks has the encrypted video . PFC Manning also 
tells Mr. Lamo that WikiLeaks is unable to decrypt the 
video . 

The tweet is also relevant to the timing of 
the transmission. United States has charged transmission 
between 1 November and 8 January of the BE22PAX video . 
United States has presented evidence that the video was 
encrypted, had the same hash value as the video in the 
CENTCOM server, and that video existed outside of the 
United States' possession. And this tweet corroborates 
that as well . 

This is also relevant to PFC Manning's 
knowledge of WikiLeaks ' plan to compromise classified 
information. PFC Manning did extensive research on 
WikiLeaks on the SIPRNET, on Intelink, he talked about it 
with Mr. Lamo, he talked about it with pressassociation, 
and Mr. Lamo testified that pressassociation has been 
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associated with Mr. Assange. 

THE COURT : You also have that it ' s relevant 
to PFC Manning's knowledge of the scope of the disclosure 
to Article 104. Please talk about that. 

MR. von ELTEN: Well, ma'am, if WikiLeaks has 
a plan to compromise classified information, and PFC 
Manning is aware of that plan, it makes his knowledge of 
when he gives information to WikiLeaks more likely that 
he knows what the effect of those compromises will be. 

Furthermore, when there's evidence of a plan 
it is evidence that — that evidence can also be used as 
proof of subsequent acts. So in this case where 
WikiLeaks has a plan to compromise information, that is 
evidence that they will compromise classified information 
in the future going forward. 

And, ma'am, Special Agent Mander also 
testified that both of the tweets are still presently on 
Twitter and that he — as of the first week of June 2013. 

THE COURT: All right. 

MR. von ELTEN: Regarding prosecution exhibit 
10 for identification which is the Internet archive 
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record, ma'am, United States offers that as a 
self-authenticating record under 902.11. United States 
has presented an affidavit stating that the record was 
made at or near the time of the occurrence set forth, it 
was kept in the regular course of business and it was 
made as part of a regularly conducted activity. 

THE COURT: So are you offering it as a 
business record? 

MR. von ELTEN: Yes, ma'am. Which goes into 
my next point that it qualifies under business records 
exception hearsay for the same reasons . 

THE COURT: The defense brief talks about the 
organization having, using a different standard affidavit 
than the one they used in this case. Can you talk about 
that? 

MR. von ELTEN: Yes, ma'am. The United 
States gave the Internet Archive a standard military 
justice form, gave it to them, gave it time to read it 
and send it back. It was just for the (INAUDIBLE) forms 
used in normal practice . The content of the form 
provided or the affidavit provided by the United States 
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is substantially similar to the content of the form of 
the sample affidavit, and it's also, the content is the 
same for self-authentication purposes as the affidavit 
presented by the defense as well . 

THE COURT: Number two in the attestation 
certificate says that the electronic systems involved can 
accurately record and reflect the files were captured at 
or near the time of the date reflected in the URL 
assigned to each file by virtue of the automatic transfer 
of electronic data. And then number three says such 
records were captured by Internet Archive or received 
from third-party donors. How does this affidavit 
accurately reflect what a third-party donor gave? 

MR. von ELTEN: Ma'am, there are two points. 
One . The Internet archive integrates these results into 
their own and therefore adopts them. 

THE COURT : How does that show that they ' re 
accurate? They just take whatever the third-party gives 
them. 

MR. von ELTEN: Also in Novack, which is 
cited by the defense, the case discusses how these 
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third-party donations originate and it 1 s done by web 
crawling crawlers which are automated processes, and 
automated processes have a lower standard of authenticity 
under Lubich . 

THE COURT: Lubich addressed web crawlers? 
MR. von ELTEN: It addressed automated 

processes . 

THE COURT: So they have a lower standard of 

authenticity? 

MR. von ELTEN: Ma'am, in Lubich an unknown 
analyst created a report, created, put information on the 
CDs that an agent then testified about the contents of 
those CDs, and the agent had some familiarity, but he 
didn't have personal knowledge of the automated process, 
and he testified that he knew it was automated and that 
he took the data and analyzed it himself . 

That is analogous to what ' s happened here 
where Internet Archive has adopted and integrated these 
records from third— party sources which are created by an 
automated process and set them forth as being accurate 
under that process. 
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Again, ma'am — 

THE COURT: Defense concession that the 
records were what the government said they were . 

MR. von ELTEN : That is true, Your Honor, 
that this would be an example of weight, not 
admissibility, that these are not accurate before the 
court . 

THE COURT: Lubich cites Weinstein to talk 
about, in general, electronic documents and records that 
are merely stored in a computer raise no computer 
specific authentication issues. If the computer 
processes data rather than merely storing it, 
authentication issues may arise. Do you consider this a 
process or a storage? 

MR. von ELTEN: Ma'am, I consider this a 
storage because it was automatically collected and the 
Internet Archive certifies that it stores records at or 
near the time. Internet Archive doesn't process them, it 
doesn't manipulate them. It essentially takes a picture, 
puts it into storage and makes it accessible for a user 
to search for it . 
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THE COURT: Well, that's where again I'm 
confused. Explain to me, you said Internet Archive takes 
the picture. 

MR. von ELTEN : Yes, ma'am. 

THE COURT: How does the third-party donation 

system work? 

MR. von ELTEN: The third-party donation 
system as explained in Novack works by the web crawler 
automatically taking the picture, and the owner of the 
web crawler donates that picture to Internet Archive . 
That would simply be a gap that would go to weight, not 
admissibility . 

THE COURT: Are you aware of any case, 
criminal case, federal or state, that has allowed 
admissibility of a website under Internet, under one of 
these affidavits as self-authenticating? 

MR. von ELTEN: Not as self-authenticating. 
However, in United States V Basnal cited by the United 
States in its brief, Internet Archive results were used 
in a criminal proceeding, and in that case they were — 
one of the bases for admission or for authentication was 
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they were compared to a previously authenticated 
document . 

In this case prosecution exhibit 110 is 
substantially similar in content to prosecution exhibit 
109 and that would be offered also as corroboration of 
the authenticity of prosecution exhibit 109 for 
identification . 

THE COURT: All right. Is that in your 

brief? 

MR. von ELTEN : That detail, ma'am? 
THE COURT: No. United States versus — 
what ' s the case? 

MR. von ELTEN: B A S N A L. Basnal . 

THE COURT: The cite is? 

MR . von ELTEN : One moment , ma ' am . 

Also in that case, ma'am — 

THE COURT: Can I have the cite for it, 

please? 

MR . TOOMAN : We ' ve got it , Your Honor . We 
can give it to them. 

THE COURT: I'd like to find it in the brief. 
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I'm not seeing it. 

MR. TOOMAN: Ma'am, it's on page four, the 
last paragraph, in the spring cites. 

THE COURT: Got it. Got it. Got it. Thank 
you . So it ' s Basnal . Okay . 

So in that case they compared it with another 
similar exhibit? 

MR. von ELTEN : Yes, ma'am. In that case the 
evidence was put forth talking about the reliability of 
the Internet Archive and then it was compared to another 
exhibit for authentication purposes . 

THE COURT: All right. Any others? 

MR . von ELTEN : No , ma ' am . 

THE COURT: What about Telewisa? 

MR. von ELTEN: Telewisa relied on an 
affidavit, ma'am. 

THE COURT: So that's not a 
self-authenticating case? 

MR . von ELTEN : No , ma ' am . 

THE COURT: Okay. I'm sorry. Proceed. 

MR. von ELTEN: Yes, ma'am. The Internet 
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Archive result is relevant because it explains why PFC 
Manning chose to compromise the information he did. PFC 
Manning conducted searches on anything related to content 
set forth in prosecution exhibit 109 for identification. 
PFC Manning admitted to compromising information 
(INAUDIBLE) as set forth there in prosecution exhibit 109 
for identification. Mark Johnson testified PFC Manning 
discussed mining the open source center. Mr. Johnson 
also testified that PFC Manning conducted research on the 
open source center related to Iceland and WikiLeaks . And 
that is a non-hearsay purpose of explaining why PFC 
Manning took the course of action that he did. 
THE COURT: All right. 

MR. von ELTEN : And PFC Manning also 
discussed compromising JTF Gitmo information with the 
pressassociation account that Mr. Johnson testified has 
been associated with Mr. Julian Assange. 

THE COURT: That was Mr. Johnson? 

MR. von ELTEN: Yes, ma'am. 

Finally, Your Honor, the United States has 
evidence that PFC Manning visited these websites . 
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Excuse me, Your Honor. The United States has 
evidence that PFC Manning visited these websites based on 
the facts listed. 

PFC Manning also wiped his computer in 
January 2010 eliminating additional evidence as Agent 
Mander testified. 

MR. TOOMAN: We'll object to that. That's 
pure speculation on the part of the government that the 
wiping of the computer eliminated any evidence . 

THE COURT: Okay. What computer? There have 
been a number of computers . 

MR. von ELTEN : Mr. Johnson testified that 
PFC Manning wiped his personal Macintosh computer. 

THE COURT: Okay. The court will disregard 
any reasons why . Go ahead . But it ' s the government ' s 
theory of the case that that's why, right? 

MR. von ELTEN: Yes, ma'am. 

Additionally Agent Shaver testified that PFC 
Manning used an unauthorized web browser which would make 
him then enable him to delete his history. 

THE COURT: On his personal computer? 
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MR. von ELTEN: On his government computer, 

ma 'am. 

THE COURT: That was Mr. Shaver? 

MR. von ELTEN: Yes, ma'am. 

THE COURT: All right. 

MR. von ELTEN: Thank you, ma'am. 

THE COURT: Defense. 

Can you go in the same order, please? 

MR. TOOMAN: Yes, ma'am. 

Your Honor, we'll begin by noting the 
government in their brief calls this a lax standard. We 
do not believe this is a lax standard. The government 
bears the burden of authenticating this information 
before it's admissible. 

THE COURT: Well, Lubich said the standard is 
not high, is that right? 

MR. TOOMAN: It may have, Your Honor. That's 
not a binding case on this court though. 

THE COURT: It isn't? 

MR. TOOMAN: I stand corrected. That is a 
military case. I apologize. 
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Your Honor, we think the more appropriate 
standard is the standard set forth in Novack . 

THE COURT: So the Novack standard is more 
important than the Lubich standard? 

MR . TOOMAN : We think that it ' s the correct 
standard, Your Honor. And there are distinctions with 
the Lubich case that I'll be happy to discuss. There we 
were talking about forensic images of computers . That ' s 
not what we ' re talking about here . We ' ve talked about 
forensic images. The forensic images in this case have 
been admitted. The reports based on those forensic 
images have been admitted. That's not what the 
government ' s attempting to introduce here . 

THE COURT: Now, Novack, does that address 

tweets? 

MR. TOOMAN: It does not address tweets, Your 

Honor . 

THE COURT: So is that case relevant to your 
109 argument or 31 and 32 as well? 

MR. TOOMAN: Well, it's relevant to 31 and 32 
as well, Your Honor, because those images are actually 
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Google cache images. So those exhibits aren't pulled 
directly from Twitter . 

THE COURT: I thought the witness said that 
he had pulled it and compared the current version with 
the Google cache version. 

MR. Von ELTEN : The witness said that he — 
one way that you could pull a tweet is to go back and 
look at it because they're all there. He also said he 
didn ' t do that . So when he was explaining how you could 
acquire this tweet, he said there are two ways, you could 
do a search using Google cache or just Google search it 
directly, the content of it, and that would pull it up, 
or you can go to Twitter. And he said what he did was 
the first way, which the first way being use a, you just 
search for it directly and pull it up on Google cache. 

And, Your Honor, Mr. Mander said the same 
thing with respect to the WikiLeaks most wanted list, 
109. He said he searched for WikiLeaks most wanted list 
and pulled it up that way . He couldn ' t get to it when he 
actually went to WikiLeaks was his testimony . 

THE COURT : Okay . Let ' s stick right now with 
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prosecution exhibits 31 and 32 . I believe I heard the 
government argue that the witness said that he did, he 
pulled it up through Google today and compared what he 
got through Google today with what he got from Google 
cache and that 1 s not the defense ' s view? 

MR. TOOMAN: Well, looking at the transcript, 
he at one point said that he didn't do that. Now, he may 
have also said, and I may have missed it when I was 
reviewing it, that that's entirely possible. But he 
definitely said there were two ways. I didn't go back 
and go through all the tweets essentially because I 
didn't want to go through thousands of tweets. 

THE COURT: Okay. 

MR. TOOMAN: So our opinion is that Google 
cache is analogous to the Internet Archive. It has some 
way that it grabs this information and there's no, 
there ' s been no discussion of that before the court . The 
court has no information on how Google cache does that . 
And so from our perspective the authentication piece 
hasn ' t been met with respect to Google cache . There 
should be, there should be some authentication from 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/18/13 Morning Session 

28 

someone from Google who would explain, hey, this is what, 
we do . 

THE COURT : What ' s the defense ' s position 
with the government? The government has two different 
authentication approaches to prosecution exhibit 31 and 
32 versus 109. 109 they're arguing self-authenticating 
with the affidavit. Plaintiff's exhibits 31 and 32 
they're arguing fall under MRE 902 by distinctive 
characteristics . What ' s the defense ' s position with 
respect to that? 

MR. TOOMAN: Our position is that it would 
not be authenticated based on distinctive 
characteristics . 

THE COURT: Does Novack deal with distinctive 
characteristics? 

MR. TOOMAN: I don't believe it does, Your 

Honor . 

THE COURT: Okay. Why would it not be 
admissible under distinctive characteristics? 

MR. TOOMAN: Well, the distinction, Your 
Honor, is a number of the factors that they talk about 
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with respect to self-authenticating based on 
characteristics, that tweet talks about dot mil 
addresses . Specifically it says we want as many dot mil 
addresses. It doesn't say we want the GAL. It doesn't 
say we want the Iraq database. 

THE COURT: I think what the government has 
argued is the tweets have come from the WikiLeaks URL 
address — what is it they argue here? 

MR. TOOMAN: Well, the tweets come from 
Google cache, Your Honor. We would also point to the 
case — I'm sorry, Your Honor. 

THE COURT: Go ahead. 

MR. TOOMAN: We would also point to the case 
cited in our brief, In Re: Home Store, which says 
printouts of (INAUDIBLE) are not self -authenticating . 

THE COURT: Well, so the government, as I 
understood the government they ' re relying on distinctive 
characteristics under MRE 902 which wouldn't be a 
self —authenticating or an MRE 901. I get my rules mixed 
up here. 

MR. Von ELTEN: Distinctive characteristics, 
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ma'am, is 901B4 . 

THE COURT: 901B4 . Okay. So the 
government's not arguing that prosecution exhibits 31 and 
32 are self-authenticating. They haven't. Are you 
saying that they have to or can they authenticate a 
different way? 

MR. TOOMAN: Well, certainly producing an 
affidavit would be one way. We would say that they 
couldn't, the distinctive characteristics here, just 
because it looks like it — anyone can create a web page 
— not anyone, but people certainly can create a web page 
that certainly looks like WikiLeaks or looks just like 
Twitter, and we provided in our motion to the court a 
number of instances where Twitter has been hacked. 

So we would say that based on that, the 
integrity of Twitter would suggest that don't just take 
it for face value, which is what the government's asking 
you to do. Hey, it was on Twitter, it must be true, 
authenticated. Well, Twitter can be hacked, it's easy to 
duplicate, so we would suggest that 901B4 wouldn't be 
appropriate for authentication with respect to the 
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tweets . 

THE COURT : What 1 s your position with the 
cases cited by the government that stand for the 
proposition that the possibility of alteration goes to 
weight, not admissibility? 

MR. TOOMAN: Could I have a moment, Your 

Honor? 

THE COURT: Yes. 

MR. TOOMAN: Your Honor, I guess we would 
rely on sort of the general rule of authentication that 
you have to be convinced that it is what they purport it 
to be . 

THE COURT: Okay. Well, would you agree that 
the standard would be not that I find it ' s what the 
government purports it to be, or a reasonable fact-finder 
in that role finds it it be what the government purports 
it to be. 

MR. TOOMAN: Yes. You are the reasonable 
fact— finder. If you're convinced, then — 

THE COURT: I'm not there yet. Okay. 

MR. TOOMAN: Would you like me to continue, 
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Your Honor? 

THE COURT: Yes. 

MR . TOOMAN : Okay . I think we ' ve covered 
authentication of the tweets . So we would move on to 
authentication of prosecution exhibit 109 for 
identification. There we believe the Novack case stands 
for the proposition that the government needs to have an 
affidavit not necessarily from the Internet Archive, but 
from someone who actually has knowledge of WikiLeaks . 
And all of this sort of ties into hearsay, there's a lot 
of overlap, but with respect to something from the 
Internet Archive and particularly the most wanted list, 
this is quadruple hearsay. 

THE COURT: Well, let's talk about 
authentication before we get to hearsay. 

MR. TOOMAN: Okay. We would suggest that 
Novack stands for the proposition that someone from 
WikiLeaks needs to testify about what was on their page 
at a certain time. When you look at the affidavit from 
Mr. Butler, he doesn't make any assertion that he has 
personal knowledge of what was taken . He says all I know 
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is what the third-party gave to us. 

And Your Honor asked a question of the 
government about process versus storage. This is 
definitely a process. There is a process that takes 
place to get this data by the third-party. 

THE COURT : Describe that process to me . 
What is this crawling? 

MR . TOOMAN : We don 1 1 know . Only the 
third— party knows . I imagine that it sounds from the 
frequently asked questions and Mr. Butler's affidavits 
and the Novack case that third parties are getting these 
websites somehow. 

THE COURT: So are crawlers going from 
Internet dot org to these third parties or do these third 
parties have crawlers and they 1 re crawling and then 
they 1 re giving things to Internet dot org? 

MR. TOOMAN: That's our understanding. So I 
might be interested in contributing to the Internet 
Archive dot org, so I set up whatever process I'm going 
to run to gather data and then I contribute it to 
Internet Archive . 
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So there 1 s no authentication of the process 
this third-party is running. A third-party could do 
anything with that information. They can gather that 
information, they can tweak it if they wanted to and then 
send it to the Internet Archive . The Internet Archive 
has no idea how that data was gathered or if it was 
manipulated at all . All they can say is Joe gave me a 
batch of data and we added it to our archive and this is 
what our archive says . We haven ' t changed what Joe or 
Bob or Phil or whoever gave it to us, but who knows what 
that individual did with it . And who knows the process . 
And we would say that there is a process, that individual 
is running a process in order to get the information. 

THE COURT: How would you address the 
government ' s contention that the reliability is enhanced 
because you can compare prosecution exhibit 109 for 
identification with prosecution exhibit 110 which was, 
you could, if you go on the Internet today and that comes 
up? 

MR. TOOMAN: I guess if you can compare them, 
you can compare them. I don't know that we would really 
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respond to that . 

THE COURT: Do you think it enhances the 
reliability, has any impact on reliability? 

MR. TOOMAN: Well, it may enhance the 
reliability, but I don't think it enhances the 
authentication. I still think there's an authentication 
issue. Because, again, we're talking about things that 
were pulled today, not things that were pulled back in 
November of 2009 as they purport them to be. The thing 
that is being compared is a present day version. We've 
gone and we have this present day version and we ' re 
comparing it to what Internet Archives says or whatever 
the process is, but in this situation we're dealing with 
present day versions . No one is looking at WikiLeaks in 
2009 and telling this court what it saw in 2009. 

THE COURT: Well, if you pull something up 
today and it says draft most wanted leaks of 2009 sort, 
and then you compare it to something that is coming out 
of this archive dot org that is also entitled draft most 
wanted leaks of 2009 sort, wouldn't that enhance the 
probability that it is what it purports to be? 
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MR. TOOMAN: It would, Your Honor. 
THE COURT: Okay. 

MR. TOOMAN: Your Honor, while we're 
addressing authentication, the government spoke about the 
process through which they acquired their affidavit and, 
if I could, I'd like to publish one of the attachments we 
provided to the court yesterday. 

THE COURT: Certainly. 

MR. TOOMAN: Your Honor, this is one of the 
attestation certificates that the government provided to 
the court. I believe it's from appellate exhibit 160. 
It's pre-admitted evidence. And this wasn't an 
attachment to our motion, but I think the court got a 
copy yesterday. 

THE COURT: Yes. 

MR. FEIN: Your Honor, may I have a moment? 
THE COURT: Yes. 
MR. FEIN: Thank you, ma'am. 
(DISCUSSION OFF THE RECORD.) 

THE COURT : This is part of the government ' s 
brief, is that correct? 
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Is this prosecution exhibit 160 or is this — 
MR. TOOMAN: No, ma'am. It's appellate 
exhibit 160. So this is one of the attestation 
certificates the government provided during a 39A we had 
last summer when they were pre-admitting documents and I 
believe this one had to do with IA training that PFC 
Manning took. 

THE COURT: Okay. Part of the defense brief. 
I knew I saw it . Got it . 

MR. TOOMAN: Yes, ma'am. So we would point 
to the attestation certificate which would be part of the 
government brief from Mr. Butler where the government set 
forth that this was what they did for expediency was they 
sent Mr. Butler there. Well, expediency would be for Mr. 
Butler to use the form that he ' s used to . And defense 
would also submit this isn't the normal form that the 
government uses. And we would just ask the court to 
compare what Mr. Butler signs and what has previously 
been used which we would say is normally what the 
government uses . 

What the government normally uses, we have 
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five paragraphs, and what Mr. Butler signed only has 
four. Some of the language has been changed. For 
example, in paragraph 1 of Mr. Butler's attestation there 
is no indication that he's a custodian of these records 
as there is in this. There is no attestation that he has 
personal knowledge in his certificate as would be 
required to authenticate. He doesn't say that it was 
made in the regular practice of his duties . And he 
doesn't say it's a complete record as is said here. 

We'll direct the court to number five, it 
says the records are a true, accurate and complete copy. 
That ' s not what Mr . Butler says . Mr . Butler says the 
records are true and accurate copies of the Internet 
Archive Wayback server. Are they complete? We don't 
know. And we'll get into the completeness a little bit 
down the road when we talk about, when I talk about 
hearsay . 

And I guess just to address Your Honor ' s 
earlier question about comparing the documents, we would 
say that the issue isn't whether or not you can compare, 
the issue is what does it look like in 2009. And nothing 
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that the court has before it tells us what any website 
looked like in 2009 or 2010. 

Move on to hearsay, Your Honor? 

THE COURT: Okay. 

MR. TOOMAN: With respect to the tweets, 
there's an issue of, we would say, double hearsay. You 
have a tweet from WikiLeaks, and then you have Google 
cache saying what WikiLeaks said in their tweet . So 
there's two levels of hearsay. And before we even get — 

THE COURT : Well , let me ask about that . On 
the Google cache they ' re pulling up just something on a 
website . What ' s the authority that you ' re relying on to 
say that that's hearsay, as opposed to just whatever is 
appearing on the website? 

MR. TOOMAN: Sure. We would say that when 
Google cache takes it and puts it up, they are saying 
what WikiLeaks said and here it is. This is what they 
said at this time purportedly, so now they're making a 
statement as to what WikiLeaks said. But really before 
we even get there, Your Honor, we would say that these 
aren't even statements. These are made by a corporation 
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or an organization. And so a declarant, has to be a 
person. So this goes to — 

THE COURT: How is it hearsay? 

MR. TOOMAN: Well, this goes to state of 
mind, the state of mind, plan and motive . It doesn ' t 
fall within the exception because — 

THE COURT: Well, it has to be hearsay first 
to get to the exception piece . The government ' s 
purported that they ' re using it for a non-hearsay 
purpose. What's your position on that? 

MR. TOOMAN: Well, I'll I address the 
non-hearsay purposes in order . First we have the state 
of mind, plan or motive of WikiLeaks was I think the 
first hearsay exception the government addressed. 

The plan or state of mind of WikiLeaks has 
nothing to do with PFC Manning. Nothing to do with him. 
They can plan and do whatever they want . That doesn ' t 
effect PFC Manning. 

THE COURT: If the government is offering 
this most wanted list, is it, and maybe, as I understand 
what they're saying is, well, here you're on the tweets. 
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Never mind. We're not talking about that 
yet. But the tweets are, as I understood what the 
government was saying, was that they were offering it for 
the fact that this is what WikiLeaks put out there. 
Whether they were actually planning on doing it or not 
was irrelevant. A reader could come and say, okay, this 
is what they're putting out there that they plan to do, 
so that ' s the relevance . Whether they actually plan to 
do it or not . 

MR. TOOMAN: We understood I guess two 
hearsay exceptions the government was relying on . One 
was the plan, state of mind, intent on WikiLeaks, and one 
was the effect on the listener. 

THE COURT: Okay. 

MR. TOOMAN: And — 

THE COURT: Start off with the plan of 
WikiLeaks then . 

MR. TOOMAN: Okay. I guess another, all of 
these are so intertwined I'm going to go back for a 
minute to authentication and it ' s an idea that is going 
to be relevant throughout this discussion, but the 
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Hopcheque or Hopchecue case the government cited in their 
brief — I'll give you a pinpoint cite of page 1121 with 
respect to authentication — that case says there has to 
be a connection between the accused or the defendant and 
the thing which you're trying to authenticate. And so, 
and we ' 11 get into the connection with PFC Manning and 
these things when we talk about hearsay as well, but we'd 
ask you to just consider that with respect to 
authentication as well . 

So first the plan, state of mind, the plan, 
motive, state of mind of WikiLeaks . 

THE COURT: So as I understand the defense, 
you ' re understanding of what the government is doing is 
they're offering it for hearsay and now it's a hearsay 
exception for state of mind? 

MR. TOOMAN: Yes. That's our understanding. 

The state of mind of WikiLeaks has nothing to 
do with PFC Manning. PFC Manning is not charged with 
conspiracy. So what WikiLeaks intends to do, it doesn't 
matter. It has no impact on PFC Manning. 

And sort of the overarching theme of all of 
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this is, you know, did he actually see any of this? Did 
he ever actually see it? So whether we're talking about 
effect on the listener or authentication, there has to be 
a connection between PFC Manning and these documents, and 
there 1 s not a connection between PFC Manning and these 
documents . 

THE COURT: Well, isn't that a question of 
fact? Right now we're talking about admissibility of 
things. As I understand the government's theory, this 
provides circumstantial evidence, it was there in 2009, 
those were the times that PFC Manning was doing the 
searches so that ' s circumstantial evidence that he might 
have seen it . 

MR. TOOMAN: Sure. Defense's position is if 
you're going to talk about the effect on the listener, 
there's got to be a listener, someone has to have heard 
it, and the person that has to have heard it is PFC 
Manning . 

THE COURT: I understand. And the defense's 
position is he didn't hear it. I got that. Isn't that 
going to ultimately be a question of fact at the end of 
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the day? 

MR. TOOMAN: Well, it is, but the defense 
believes that you have to resolve that piece when 
determining the admissibility because in order to rule on 
the hearsay exception of effect on the listener, Your 
Honor would have to determine that there was a listener 
and that there was enough evidence that he actually heard 
it. Otherwise it shouldn't be admitted as not a hearsay 
exception, but as non-hearsay. 

THE COURT : So it's the defense ' s position 
that it shouldn't be admitted as a stepping stone that 
this is the government theory of the case, opportunity to 
look, could have seen the statement, therefore the impact 
was that ' s why he acted like he acted, that that 
foundation, because it's a foundational piece and doesn't 
absolutely establish the connection that it shouldn't be 
admitted. 

MR. TOOMAN: Right. The defense position is 
if you're going to admit something for the non— hearsay 
purpose of effect on the listener, you need to prove that 
he heard it . You have to convince the reasonable 
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fact— finder , Your Honor, that PFC Manning heard it. And 
there 1 s — 

THE COURT: Again, that's the fact finding 
piece later on. Right now I'm just doing as a question 
of law the admissibility of the document at issue . 

MR . TOOMAN : Right . 

THE COURT : So you ' re saying I need to make 
that finding in this step, this level now, too? 

MR. TOOMAN: Right. Our position would be 
Your Honor needs to determine whether or not PFC Manning 
heard it. And then if you determine that it's reasonable 
that he heard it, then it would be, then you could admit 
it and then make a determination based on the facts what 
weight to give it . And so the government ' s pointed to 
circumstantial evidence that PFC Manning may have seen 
them, and our position is the circumstantial evidence 
that he didn ' t see it far outweighs any circumstantial 
evidence that he did. And I'll address those tweets in 
turn . 

THE COURT: Okay. 

MR. TOOMAN: And the list. So prosecution 
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exhibit. 31 is the email list. The email list — first of 
all, there's mountains of forensic evidence in this case, 
particularly, you know, the government likes to point to 
the fact that PFC Manning ' s machine was wiped in late 
January. With respect to the May tweet, that evidence 
would be there. And with respect to the dot 22 machine, 
his primary SIPR machine, it would be there as well. 

And so the forensic experts, Mr. Shaver and 
Mr. Johnson, who have testified about the primary SIPR 
and the personal Mac, they looked for anything related to 
WikiLeaks . Anything. And they didn't find tweets on PFC 
Manning's computer. They found all sorts of other things 
to do with WikiLeaks . They found things to do with 
WikiLeaks in April . So it ' s not an issue of him having 
cleared his Internet history. So if he had seen the 
tweet in May, there would be evidence of it on one of his 
computers , and there ' s not . 

And our opinion is that outweighs the fact 
that they had had a tweet about email addresses and then 
he downloaded email addresses. We think that the fact, 
and I guess also relevant to this discussion is the 
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supply room computer where we had the stipulation of Mr. 
Williamson and Mr. Williamson didn't find any references 
to Twitter on the supply room computer where there would 
have been . There was all sorts of other things tying 
that computer to PFC Manning, his Gmail account, 
purchases on Amazon, other activity that was clearly done 
by PFC Manning, but there was no, there was no Twitter or 
WikiLeaks on the supply room computer. And so those are 
the computers which PFC Manning would have used to access 
Twitter and there ' s nothing on there . And so our 
position is that that outweighs the circumstantial 
evidence provided by the government and PFC Manning 
didn ' t see that tweet . 

With respect to the next tweet, the video 
tweet, again, no Internet history, no evidence of him 
having viewed it in January, and the government points to 
references in chats later in the spring. At no point 
does PFC Manning say he gave WikiLeaks the encrypted 
video . He never says that . He says they have it . 

He had a number of chats with 
pressassociation, could have learned it there. 
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In his providence inquiry he told the court 

THE COURT: That I'm not interested in. 

MR. TOOMAN: Okay. There are a lot of ways 
that PFC Manning could have learned about that video . 
The government hasn't established that he learned it from 
the tweet . There ' s no forensic evidence pointing to the 
tweet . They haven ' t found a Twitter account of PFC 
Manning that shows him following WikiLeaks . And all of 
the evidence we ' ve heard about the Farah video has 
pointed to a couple things . 

First, the brigade material of this Jason 
Katz character who has it in December of 2009 and has no 
connection whatsoever to PFC Manning. That's where we've 
heard about the Farah video. Someone has the same 
version, hash value, same version as CENTCOM. 

THE COURT: I understand all of this for your 
closing argument. Where I'm having trouble following 
this is we're talking with admissibility of the tweet. 

MR. TOOMAN: Sure. Again, Your Honor, the 
relevancy of this is conditioned upon a fact and the 
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admissibility of this evidence is based on whether or not 
he heard it. So our position is this is something that 
you need to determine right now. 

THE COURT: Is it relevant that if it's there 
at the time that he had an opportunity to hear it? 

MR. TOOMAN: I'm sorry. 

THE COURT: Wouldn't it be relevant, because 
the tweet is there at the time that PFC Manning is 
involved in WikiLeaks, that he had an opportunity to see 
it? 

MR . TOOMAN : No . We don ' t think so . We 
think that you would have to show that he actually saw 
it. For something to effect PFC Manning, he has to 
actually have seen it. He has to, otherwise it can't 
affect him. 

THE COURT : I agree with you on that . 

MR . TOOMAN : So that ' s what we think the 
court has to determine now is did he hear it, did he see 
it, does the evidence that we've heard — 

THE COURT : All right . So you ' re saying that 
the admissibility for — so you're saying that the 
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opportunity to see it, it's the defense's position is 
that that ' s not enough . 

MR. TOOMAN: No. That's correct, Your Honor. 
That ' s correct . 

THE COURT: Now, the cases that you cite for 
that, I don't remember offhand the exact name of the 
case, but the one I'm thinking of is where, the murder 
case where the defendant was trying to say that a 
third— party killed the victim and wanted to introduce 
statements from two witnesses that said that the 
third-party made statements — refresh my recollection on 
that . The third-party made statements that they — 

MR. TOOMAN: Well, Your Honor, the federal 
case, Brandon V Villas of Maywood, there was a 1983 
claim, and you had an alleged drug dealer, and then there 
were two women who said, hey, are you working today or 
allegedly said, hey, are you working today. And so what 
the court needed to determine was whether or not the 
officers actually heard that to determine whether or not 
they had probable cause that he was engaged in drug 
activity. So there the court had to figure out, did 
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these police officers actually hear what those women 
said? If they didn't hear it, then there could have been 
no effect on them. 

THE COURT: I'm mixing up two cases. I've 
got that case and New Mexico versus Rosales where you 
have the court excluded witness testimony that victim 
said that third-party owed him a debt . There was no 
evidence that the third-party knew about the debt . 

So do either of these cases address 
opportunity? I mean in both of these cases I think it 
was pretty clear that the person didn ' t hear it . 

MR. TOOMAN: Right. I don't believe they do 
address opportunity, Your Honor. I believe they address 
whether or not the person actually heard it . 

THE COURT: Are you aware of any case that 
does address that? 

MR. TOOMAN: We're not, Your Honor. And this 
seems to us a fairly obvious proposition that for there 
to be a listener, you've got to have heard it, so we're 
not aware of any case . 

THE COURT: Okay. 
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MR. TOOMAN: With respect to, so I guess all 
we just talked about would apply to the WikiLeaks most 
wanted list as well. And there, Your Honor, we believe 
there ' s quadruple hearsay . You have the defense exhibit 
of the other version of the WikiLeaks most wanted list 
that has the introductory — 

THE COURT: Was that introduced? 

MR. TOOMAN: It was, yes, Your Honor. 

THE COURT: That was defense exhibit? 

MR. TOOMAN: I think it was J or F . Maybe F. 

It's F, Your Honor. 

THE COURT: May I see that from the court 
reporter as well? 

All right . I have it . 

MR. TOOMAN: So what this list makes clear is 
that WikiLeaks wants journalists, activists, historians, 
lawyers, police and human rights investigators to send 
them things that they are interested in. If there's a 
piece of information that you know is out there that 
exists and it would help you do whatever it is that you 
do, send it to us and we'll add it to the list. So this 
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list is populated by statements from those people . And 
then the list itself is a statement . And then the 
third-party, whoever provided that web page to Internet 
Archive is making the statement that this is what I saw 
and this is what I'm telling Internet Archive. And the 
Internet Archive is making the statement that this is 
what WikiLeaks had on their site on whatever day. 

THE COURT : Let 1 s go statement by statement . 
If you're talking about the actual statement itself, the 
most wanted list, what these countries actually wanted, I 
believe the government ' s position is it ' s not being 
offered for the truth that countries really wanted that 
stuff, it's being offered for what's being put on the 
Internet for other people to see . And then the impact it 
would have on PFC Manning as we talked about earlier if 
he saw it . 

MR . TOOMAN : Right . 

THE COURT : So what ' s the defense ' s position 
with that non— hearsay purpose? 

MR. TOOMAN: That's probably a reasonable way 
to look at that, we would say, for that first level of 
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hearsay . 

THE COURT: So let's go to level two. 

MR. TOOMAN: Level two. Here's where we 
think that somebody needs to come from WikiLeaks, 
actually comes in and authenticates this . WikiLeaks are 
the people who have the knowledge, the personal knowledge 
of their list . So they ' re the ones in our view who need 
to authenticate it . They ' re the only ones who can . 
Because there's no one who — well, certainly someone 
probably saw this list in November of 2009, but they've 
not testified before this court. And so absent someone 
who actually saw this site in 2009, it would have to be 
WikiLeaks to come in here and say this is what our site 
looked like in 2009. 

THE COURT: Now, you've cited Novack 
basically as for that proposition. Are you aware of any 
other cases other than Novack that have gone the same way 
that you ' re discussing? 

MR. TOOMAN: There are a series of cases that 
cite Novack, I don't know that any of them are exactly on 
point . But the decision in Novack was reviewed on appeal 
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and it was upheld, at least with respect to the 
evidentiary rulings . 

THE COURT: Now, are you aware of any cases 
that have gone the other way, criminal cases? 

MR . TOOMAN : No , ma ' am . 

THE COURT: How would you distinguish the one 
the government is talking about? 

MR. TOOMAN: The way we would distinguish the 
way the one the government is talking about is, again, 
we ' re not talking about forensic images here . 

THE COURT: That's the. 

MR. TOOMAN: Lubich, I believe, Your Honor. 
We think the evidence here is fundamentally different 
than the evidence that Lubich considered. 

THE COURT: Not Lubich. The Basnal case. I 
think you gave me the cite for it . The government has 
purported, and again, I just got this stack of 
information, I haven't read everything yet, but Basnal, 
it says they compared it with a similar exhibit . 

MR . TOOMAN : Right . In Basnal they compared 
it to something that had already been authenticated. So 
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here, that's not what we have here. We don't have 
anything that's been authenticated. So if they're able 
to authenticate the list and then pull the list off of 
archive dot org, I guess that would work, but I don't 
know why they would need to do that if they already had 
an authenticated list . 

THE COURT: And what's the third level of 

hearsay? 

MR. TOOMAN: The third level of hearsay is 
the individual who collected it off of WikiLeaks and then 
donated it to archive dot org. And we believe that that 
person would be required to testify because they would 
have to authenticate it with respect to did they alter it 
in any way, the same way they would have to, anyone else 
would have to attest this is the process I go through, I 
normally do this, this is — 

THE COURT: How would you distinguish that 
from business records cases that rely on MRE 806.6 and 
902.11 where an entity has incorporated something from 
another entity in the course of its business? As I 
understand the case law, that ' s been accepted so long as 
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the entity giving the affidavit says this is how I do 
business and I routinely use records from entity B? 

MR. TOOMAN: Right. Well, we would say that 
here they haven't, they haven't authenticated, they being 
Internet Archive, Mr. Butler, hasn't authenticated 
anything that that third-party did. They don't, Mr. 
Butler, in all likelihood, doesn't know who that 
third-party even is. My guess is the cases would flush 
out that it would be someone you ' re doing business with 
and you have some sort of relationship with, and the 
person who is attesting would have that relationship . 

Here Mr. Butler doesn't says he knows these 
people, he just knows we get this information from them. 
We don't know how it's acquired. 

THE COURT: Well, you're getting bankrupt, 
for example, and records of someone's checks. Someone 
else would be giving the checks to the bank and the bank 
is collecting the checks. What's the difference? 

MR. TOOMAN: Well, there I think the check, 
that would be something that speaks for itself on its 
face. You can see the check and you can see if the check 
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had been altered. You would just by looking at it be 
able to tell, okay, hey, this, nothing looks fishy here. 
With these Internet Archive, with these websites, who 
knows? You don't know. You can't look at a website and 
tell if it ' s been altered in any way facially just by 
looking at it . 

And so, I guess finally, Your Honor, I think 

we ' ve — 

THE COURT: Level one, two and three. You 
said quadruple hearsay. What's level four? 

MR. TOOMAN: That's Internet Archive's 
attestation. And again, we don't think that that's 
adequate in this case because the attestation makes clear 



THE COURT: Level three and four are the 

same? 

MR. TOOMAN: No. Three is that third-party, 
and then four is Internet Archive . 

THE COURT: So are you really saying that 
that ' s a hearsay objection or really that the 
authentication just is not good enough? 
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MR. TOOMAN: Well, I would say it's both. 
THE COURT: How is it hearsay? Why would it 
be hearsay when every other authentication is not 
(INAUDIBLE) . 

MR. TOOMAN: Internet Archive holding it out 
and saying this is what this site said at this time, 
that ' s a statement in our view . 

THE COURT: Okay. Got it. 

MR. TOOMAN: Finally, Your Honor, we also 
have a relevance objection to all three of these things. 
Really these documents, they go towards the government's 
theory of their case, but that's all they go to. They go 
towards the theory. They don't make a fact in 
consequence any more likely than not . 

THE COURT: Opportunity doesn't make a fact 
in consequence more likely? 

MR. TOOMAN: I'm sorry, Your Honor. 

THE COURT: Opportunity wouldn't make the 
fact in consequence more likely? 

MR. TOOMAN: Whether or not PFC Manning saw 
any of these things doesn't make it any more likely than 
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not that he had actual knowledge that the enemy used 
WikiLeaks , doesn 1 t make it any more likely that he could 
have known that release of this information could cause 
damage, it doesn't make it any more likely that this is 
worth some amount or another amount. And so our position 
is that it doesn't make any fact in consequence more or 
less likely. 

And what ' s interesting about that is the 
version of the website that the government provided, and 
we think just looking at the version and comparing it to 
the defense ' s version makes clear that all of this goes 
to is their theory of the case. They've given you the 
version they want you to think PFC Manning saw. But 
there's another version, and that's the version the 
defense has given the court that would be inconsistent 
with their theory . 

THE COURT: Just to make sure I understand 
the testimony, is it defense, as I understood the 
testimony, and correct me if I'm wrong, when you pull up, 
or the investigator testified when he pulls up WikiLeaks 
today you get a multiple number of these lists . 
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MR. TOOMAN: I believe his testimony, Your 
Honor, was he couldn't get to the list when he went to 
WikiLeaks . He would have to Google search WikiLeaks most 
wanted list 2009 and then multiple versions come up. But 
when he actually goes to WikiLeaks, he couldn't find it. 

And so just based on that, you see multiple 
versions come up, the government's chosen the one that is 
consistent with their theory; not the one that advances a 
fact in evidence, the one that's consistent with their 
theory. It's no more likely because they're basically an 
unsorted version and a sorted version. The unsorted 
version has the introductory language that talks about 
WikiLeaks mission and wanting to have political impact 
and things like that. That's the one that talks about, 
that really talks about the state of mind and the intent 
and the plan of WikiLeaks . That ' s not the version the 
government ' s offered because that ' s not consistent with 
their theory that WikiLeaks — 

THE COURT: I understand that. 

MR. TOOMAN: So it doesn't go to a fact in 
evidence . The government should have introduced both 
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versions if they think he had just as likely an 
opportunity to see the unsorted version as he had the 
sorted version. 

THE COURT : That ' s why we have an adversarial 
process, right? 

MR. TOOMAN: Yes, ma'am. Absolutely. To us 
though it ' s clear that it doesn ' t go to any fact in 
evidence, or it doesn't go to making something more or 
less likely, it just goes to their theory of the case, 
and that's not the basis for admissibility. It has to 
make a fact in consequence more or less likely. And the 
list and the tweets, they don't do that. 

THE COURT: Thank you. 

MR . TOOMAN : Thanks , ma ' am . 

THE COURT: Government, any final reply? 

MR. Von ELTEN : Yes, ma'am. 

THE COURT : I'd also ask you to distinguish 

Novack . 

MR. Von ELTEN: May I have a moment, Your 

Honor? 

THE COURT: Yes. 
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MR. Von ELTEN : Would you like me to start by 
distinguishing Novack? 

THE COURT: Yes. 

MR. Von ELTEN: First of all, ma'am, Novack 
admits the reliability of Internet Archive results for 
the availability of information to the public in prior 
art cases, so what is known about the originality of a 
patent claim. 

Novack sits apart from other cases in its 
skeptical treatment of electronic evidence and the 
Internet Archive in particular. The United States has 
provided other cases where the Internet Archive has been 
relied on in adversarial proceedings based on — defense 
has cited where affidavits have been sufficient to 
justify the reliability of the Internet Archive. 

THE COURT: I think I asked you earlier if 
any criminal cases that you were aware of that allowed 
Internet Archive and you gave me one . 

MR. Von ELTEN: Yes, ma'am. That's the only 
one I'm aware of, ma'am. 

Ma'am, Google cache or any automatically 
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generated result is a machine generated process and it ' s 
not hearsay any more than a photograph. 

The defense has submitted evidence in its 
brief attesting to the reliability of the Internet — 

THE COURT: Let me go back. You talked about 
Google cache is automatically generated and the result is 
not hearsay. I believe the defense's position to me was 
it is a statement by Google cache basically saying that 
what I am pulling up is, in fact, what was there in 2009. 

MR. Von ELTEN : Ma'am, it's akin to server 
logs. Google cache just says this is a recent version as 
Google has found, so it ' s akin to server logs . They just 
automatically generate the results based on the automated 
process . 

THE COURT: Okay. 

MR. Von ELTEN: But as for the evidence that 
the defense has provided to the authenticity, enclosure 
one, I believe, of the defense brief. I will address 
Google cache and the Wayback machine separately, although 
most of the information applies to both. 

Both the Google cache and the Wayback machine 
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contain information at only one point in time . Google 
cache let ' s you know the page that you are viewing is 
only a snapshot of how a page is when it looked at a 
specific time. Further, the enclosure states the Wayback 
machine keeps multiple copies of the same capture on 
different days. Again, ma'am, that is what the United 
States is offering that for. And finally, I quote, for 
any of the cash services you are essentially looking at a 
window of what occurred, end quote . 

The defense has raised concerns — 
THE COURT: Let me ask another question on 
that and I'll ask the defense this too. This enclosure 
talks about webs being sort of streaming. You know, if 
you're watching CNN it changes every minute, they got a 
new story now, and then you pull it up a minute later and 
that story disappeared and they have a new one at the 
top. Is that the same thing we're talking about when 
we're talking about these lists? Are they fixed 
documents or things constantly changing on the screen? 

MR. Von ELTEN: Yes, ma'am, a document as it 
exists on a web page can be changed. However, in this 
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case, prosecution exhibit. 109 for identification is a 
snapshot of what the document looked like in November of 
2009. Prosecution exhibit 110 is a snapshot of the 
document as it exists today. As defense has pointed out, 
the introductory language has been changed, but much of 
the content is substantially the same. 

THE COURT : What ' s your position with respect 
to defendant's exhibit Foxtrot? This also exists today. 
If I compare it to prosecution exhibit 109, it's not the 
same . 

MR. Von ELTEN : No, ma'am, it's not exactly 
the same, but there are substantial overlap. And that 
overlap authenticates that this is how it existed back 
then. The United States has provided independent 
evidence through the Internet Archive that that is how it 
existed back then, and changes have been made in the 
interim, but the fact that a few changes have been made 
also authenticates the document . 

THE COURT: All right. 

MR. Von ELTEN: Defense raised the content of 
the affidavit. Ma'am, I'd just like to point out the 
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elements on that attested personal knowledge, that the 
information was captured at or near the time, was part of 
regularly conducted activity, and that they were true and 
accurate copies. But makes it a business record. 
Furthermore, Your Honor, there is case law to support 
where a business integrates documents that those qualify 
as records of the organization actually holding them, 
United States versus Debonay. 



THE COURT: Is that in your brief? 



MR. von ELTEN : No, ma'am, it's not. 



THE COURT: Okay. What's the cite for 



Debonay? 



MR. von ELTEN: 



28 M.J. 929. 



United States also points to — 



THE COURT: Is that a (INAUDIBLE) case? 



MR. von ELTEN: No, ma'am, that is a United 



States Marine Corps Court of Military Review. 



THE COURT: What year? 



MR. von ELTEN: 



1989. 



THE COURT: Okay. 



MR. von ELTEN: 



And also a Fifth Circuit 
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case, United States versus Orich, which is a 1978 case. 
I have a copy for the court and the defense, ma'am. 

THE COURT: Thank you. 

MR. von ELTEN : May I approach? 

THE COURT: Yes. 

MR. von ELTEN: Furthermore, ma'am, there's 
no evidence of tampering or intent to tamper . And 
prosecution exhibit 109 is a different list from 
prosecution exhibit — 109 for identification is a 
different list from prosecution exhibit 110. And the 
defense has offered no evidence that prosecution exhibit 
109 for identification has changed. The arguments that 
they make (INAUDIBLE) . 

And to clarify one additional fact, ma'am, 
Agent Shaver testified PFC Manning used Mozilla Firefox 
on his SIPRNET computer which was configured to delete 
browsing history. He has not testified regarding the 
NIPR computer to which PFC Manning had access. 

THE COURT: Wait a minute. Say that one more 

time . 

MR. von ELTEN: Agent Shaver testified that 
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PFC Manning used Mozilla Firefox on his SIPRNET computer. 
Agent Shaver testified that the Firefox browser was 
configured to delete browsing history. 

THE COURT: And this is, had Mozilla on which 

computer? 

MR. von ELTEN : On his SIPRNET computer. 
Agent Shaver has not testified concerning the NIPR 
computer to which PFC Manning had access to in the SCIF 
where PFC Manning worked. 

THE COURT: And that is relevant why? 

MR. von ELTEN: I just wanted to clarify what 
I told you earlier, Your Honor. 

MR. MORROW: If I could, Your Honor, he just 
misspoke earlier, so we're clarifying. 

THE COURT: Okay. 

MR. von ELTEN: Finally, Your Honor, the 
defense raises arguments regarding the weight of the 
evidence, not the admissibility, and should present that 
evidence in the case in chief . 

Thank you. 

THE COURT: Hold on just a minute. 
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MR. von ELTEN : Yes, ma'am. 

THE COURT: MRE 902.11 requires the 
certificate to state that the record was made at or near 
the time of the occurrence of the matter set forth by or 
with information transmitted by a person with knowledge 
of those matters . How does the attestation from archive 
dot org say that? 

MR. Von ELTEN: Ma'am, the attestation says 
that the records were created in Internet archives 
results at or near the time. Paragraph two. To the best 
of the electronic systems involved and accurately record 
and reflect, such files were captured at or near the time 
the date reflected in the URL. 

THE COURT: This is where I'm confused again. 
This crawling process, is Internet dot org crawling or is 
a third-party crawling? 

MR. von ELTEN: Internet Archive is attesting 
that the documents were captured at the time reflected in 
the URL. 

THE COURT: Captured by Internet dot org or 
captured by someone else? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/18/13 Morning Session 

71 

MR. von ELTEN : Either system, ma'am. 

THE COURT: So it could be a donated, 
something donated as well? 

MR. von ELTEN: Yes, ma'am. But Internet dot 
org relies on those and integrates them into their 
records. And, ma'am, the defense has presented no 
evidence that prosecution exhibit 109 for identification 
was donated. 

THE COURT : Well , you haven ' t presented any 
that this was captured by Internet Archive, have you? 

MR. von ELTEN: We have the affidavit. 

THE COURT : It says were captured or were 
received by a third-party. So we don't know really. 

MR. von ELTEN: There's no definitive 
evidence , ma ' am . 

THE COURT: Defense, any final words? Well, 
the government has the final words, but any further 
words? 

MR. TOOMAN: Yes, ma'am. 

I believe you wanted us to address whether or 
not the list or the web is a fixed document. 
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THE COURT : Yes . I mean do you see the 
distinction here? As I'm looking, is this a streaming 
video, is this like prosecution exhibit 109 for 
identification, when you pull it up, is it like CNN, it 
changes, something drops off at the end and something new 
comes up in the beginning? 

MR. TOOMAN: Well, we don't know, Your Honor. 
We would say that based on defendant's exhibit Foxtrot, 
that would suggest that this is a list that is being 
added to . There ' s the opportunity to add things to it . 
And so in our mind that would make it a live document . 
Things could get added later, maybe they'd get something 
and then take it off, so we don't know. But certainly 
the introductory language would suggest that it is a 
living document that ' s going to change over time . 

THE COURT: Okay. 

MR. TOOMAN: If I may publish, Your Honor, 
the affidavit the defense received from Mr. Butler. 

THE COURT: Certainly. That would be, for 
the record, enclosure ten to your brief? 

MR. TOOMAN: Yes, ma'am. I will zoom in here 
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on paragraph seven. And paragraph seven of this says 
that for the year 2009 Internet Archive largely, and I'm 
not quoting here, but it mostly relied on third parties 
to donate . Third parties were the ones making the 
donations. So in this case we don't know. It's possible 
that Internet Archive could have done it , but it ' s more 
likely that it would have come from a third-party. And 
this attestation says that these were, they don't know if 
the person who got it has personal knowledge . The last 
sentence there of paragraph seven, do not affirm that 
these archives were, or people with the knowledge of the 
information recorded therein. So we would say that it 
fails the 211 analysis. And that's in part because the 
snapshot that these archives give us are just that, 
they're a snapshot, and we don't know whether or not the 
process by which they were acquired is valid because 
we ' re not hearing from those people . 

The government referenced Mozilla Firefox and 
deleting browsing history. Your Honor, I don't recall if 
we asked Agent Shaver this question, but if we didn't, 
we ' 11 ask him the next time he ' s on the stand and he ' 11 
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tell us that deleting Internet history in Mozilla Firefox 
is a default setting. So if he hasn't already said it, 
he will say it . 

THE COURT : I don ' t recall him saying it . 
That doesn't necessarily mean it's not on the record. 

MR. TOOMAN: I don't recall him saying it 
either, but I'm proffering to you he will say it the next 
time he's on the stand. 

THE COURT: So the web deleting history is 
the default setting? 

MR. TOOMAN: The government just brought up 
that Mozilla Firefox was set up to clear browsing 
history . 

THE COURT: I got it. Government, do you 
agree with that? 

MR. MORROW: Yes, Your Honor. It was 
configured to delete browsing history, and we would agree 
that that may or may not be the default assist setting. 

THE COURT: They're saying it is the default 
setting . You ' re saying it may or may not be . 

MR. MORROW: I don't recall if that's the 
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default setting of Mozilla. It could be. But the point 
is the history doesn't exist because it was configured 
that way. 

THE COURT : All right . You all can ask him 

the question. 

MR. TOOMAN: Yes, ma'am. We've only done a 
very brief review of the Debonay case, but we would point 
out that that is the check case, like Your Honor 
mentioned, and we think we've addressed the differences 
there . With the check you can kind of look at it and 
see. And also, that was, it appeared that that was kind 
of a normal thing, like these people would always send 
checks and so, again, there was that understanding of how 
the system was working. 

Here with Internet dot org or archive dot org 
it's an ad hoc process. You have someone, maybe you 
decide one day I ' m going to do it and I give them some 
stuff and I decide I don't want to do it any more. So 
Internet Archive dot org doesn ' t have any knowledge of 
the process . 

THE COURT : Assume what you said is correct 
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now. Would that have any bearing on the validity of 
what ' s there if it may not be complete? You may not be 
able to go back to January 1 of 2009 and see every 
website that's in existence, but does that mean the ones 
you can see have reliability issues? 

MR. TOOMAN: We think it does. The person 
who actually took the site, you have to have someone with 
personal knowledge . And certainly Internet Archive has 
personal knowledge of what someone gave them. And they 
can tell you all day this is what Bill gave or whoever 
gave us, but they can't say that the process they used 
was a valid process or stuff hasn't been tampered with. 

Subject to your questions, ma'am. 

THE COURT: I think I just asked them. Thank 

you . 

Government, any last words? 

MR. von ELTEN : Yes, ma'am. The attestation 
highlighted by defense also says that the archive data 
obtained from the third-party organizations was, quote, 
captured by automated electronic systems, end quote. 

THE COURT : You ' re reading paragraph seven 
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again? 

MR. von ELTEN : Yes, ma'am. 

THE COURT: All right. Anything else? 

MR . von ELTEN : No , ma ' am . 

THE COURT: All right. I believe we 
discussed yesterday that we will be holding a status 
conference on Tuesday at 0930 and the plan will be then 
to proceed with additional taking of evidence on 
Wednesday at 0930. Is that the understanding of the 
parties? 

MR. FEIN: Yes, ma'am. 
MR. COOMBS: Yes, Your Honor. 
THE COURT: Is there anything else that we 
need to address that's going to disturb that? 
MR. FEIN: No, ma'am. 
MR . COOMBS : No , ma ' am . 

THE COURT: Anything else we need to address 
at all before we recess the court? 

MR. FEIN: No, ma'am. 

MR . COOMBS : No , ma ' am . 

THE COURT: Court is in recess. 
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